Fair Credit Reporting Act and AI use cases

Annex III point 5(b): AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are high risk, except systems used to detect financial fraud. Providers need risk management, data governance, logging and human oversight. Deployers must carry out a fundamental rights impact assessment before use (Article 27), and affected persons have a right to an explanation of individual decisions from the deployer (Article 86).

A score used to decide whether a natural person is offered housing evaluates creditworthiness in substance, which is the likely reading of Annex III point 5(b) when the outcome is a rental decision rather than a loan, though the annex text itself only names creditworthiness evaluation and credit scoring. The provider of such a high risk system carries risk management, data governance and conformity assessment obligations; the deployer, the landlord or property manager, must use it according to its instructions, ensure human oversight, monitor its operation and keep logs under Article 26, and, where it falls under Annex III point 5(b), carry out a fundamental rights impact assessment under Article 27.

Annex III point 5(b): AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are high risk, and a real time BNPL underwriting model is squarely this use, since it is the system making the credit decision rather than a supporting tool. Providers need risk management, data governance, logging and human oversight; deployers must run a fundamental rights impact assessment (Article 27), and consumers have a right to an explanation of an individual decision (Article 86).

The drafting assistant does not assess creditworthiness, so on its own it is not the Annex III point 5(b) credit scoring system. It helps the lender meet the Article 86 right of affected people to a clear and meaningful explanation of decisions based on such a high risk system. If it is built into the scoring system it shares that system's high risk obligations; as a separate drafting tool its tier depends on its design and on how its output is reviewed. The follow up chat assistant must tell customers they are dealing with an AI system (Article 50).

Annex III point 5(b) excludes AI used to detect financial fraud from the high risk credit scoring category, but a system that in effect decides on creditworthiness is high risk, and remote biometric identification is high risk under point 1(a), which excludes one to one biometric verification. When a public authority uses the model on claims for public benefits, point 5(a) can apply, because it covers AI used to grant, reduce, revoke or reclaim benefits and has no fraud exception. Keep fraud detection separate from the credit or eligibility decision and use biometrics only for one to one verification.

Classification and indexing of documents for a person to review may fall under the Article 6(3) derogation for narrow procedural tasks, if the provider documents that assessment. That derogation does not apply once the system profiles a natural person: calculating a named borrower's qualifying income from their pay stubs and bank statements evaluates that person's economic situation, which is profiling under GDPR Article 4(4). A system intended to calculate qualifying income for the credit decision is high risk under Annex III point 5(b), evaluating the creditworthiness of natural persons, whether or not a person reviews its output. Human oversight of that output is a separate obligation under Article 14, not a way to take the system out of the high risk category.

Verifying documents and third party data for a person or system to use is a narrow procedural task under Article 6(3) when the credit decision itself is made separately. That derogation does not save the system if it profiles natural persons: Article 6(3)'s last subparagraph makes an Annex III system high risk regardless of the procedural task exception when it does. Calculating an applicant's income and checking it against what people in that job are normally paid, which is how Informed.IQ describes its Ally Financial deployment, evaluates a person's economic situation and is profiling under GDPR Article 4(4), so that step will usually be high risk unless it is strictly limited to checking document authenticity rather than calculating or assessing income. Annex III point 5(b) separately excludes AI used to detect financial fraud from the high risk credit scoring category, which covers this use case's fraud screening step on its own. The tier also changes if the verification result automatically decides or materially narrows a consumer's access to auto financing, since retail auto loan applicants are natural persons: that use falls under Annex III point 5(b) as evaluating creditworthiness directly.